2e933dceb5
A system-scoped token implies the user has authorization to act on the deployment system. These tokens are useful for interacting with resources that affect the deployment as a whole, or exposes resources that may otherwise violate project or domain isolation. Since Queens, the keystone-manage bootstrap command assigns the admin role to the admin user with system scope, as well as in the admin project. This patch transitions the Keystone admin user from authenticating using project scoped tokens to system scoped tokens. This is a necessary step towards being able to enable the updated oslo policies in services that allow finer grained access to system-level resources and APIs. An etherpad with discussion about the transition to the new oslo service policies is: https://etherpad.opendev.org/p/enabling-system-scope-in-kolla-ansible Change-Id: Ib631e2211682862296cce9ea179f2661c90fa585 Signed-off-by: Niklas Hagman <ubuntu@post.blinkiz.com>
62 lines
2.2 KiB
YAML
62 lines
2.2 KiB
YAML
---
|
|
- name: Waiting for Murano API service to be ready on first node
|
|
wait_for:
|
|
host: "{{ api_interface_address }}"
|
|
port: "{{ murano_api_port }}"
|
|
connect_timeout: 1
|
|
timeout: 60
|
|
run_once: True
|
|
register: check_murano_port
|
|
until: check_murano_port is success
|
|
retries: 10
|
|
delay: 6
|
|
delegate_to: "{{ groups['murano-api'][0] }}"
|
|
|
|
- name: Checking if Murano core and applications library packages exist
|
|
become: true
|
|
command: >
|
|
docker exec murano_api murano
|
|
--os-username {{ openstack_auth.username }}
|
|
--os-password {{ openstack_auth.password }}
|
|
--os-system-scope {{ openstack_auth.system_scope }}
|
|
{% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %}
|
|
--os-auth-url {{ keystone_admin_url }}
|
|
--murano-url {{ murano_admin_endpoint }}
|
|
package-list
|
|
register: status
|
|
changed_when: False
|
|
run_once: True
|
|
delegate_to: "{{ groups['murano-api'][0] }}"
|
|
|
|
- name: Importing Murano core library package
|
|
become: true
|
|
command: >
|
|
docker exec murano_api murano
|
|
--os-username {{ openstack_auth.username }}
|
|
--os-password {{ openstack_auth.password }}
|
|
--os-system-scope {{ openstack_auth.system_scope }}
|
|
{% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %}
|
|
--os-auth-url {{ openstack_auth.auth_url }}
|
|
--murano-url {{ murano_admin_endpoint }}
|
|
package-import --exists-action u --is-public /io.murano.zip
|
|
run_once: True
|
|
delegate_to: "{{ groups['murano-api'][0] }}"
|
|
when:
|
|
- status.stdout.find("io.murano") == -1 or kolla_action == "upgrade"
|
|
|
|
- name: Importing Murano applications library package
|
|
become: true
|
|
command: >
|
|
docker exec murano_api murano
|
|
--os-username {{ openstack_auth.username }}
|
|
--os-password {{ openstack_auth.password }}
|
|
--os-system-scope {{ openstack_auth.system_scope }}
|
|
{% if openstack_cacert != '' %}--os-cacert {{ openstack_cacert }}{% endif %}
|
|
--os-auth-url {{ openstack_auth.auth_url }}
|
|
--murano-url {{ murano_admin_endpoint }}
|
|
package-import --exists-action u --is-public /io.murano.applications.zip
|
|
run_once: True
|
|
delegate_to: "{{ groups['murano-api'][0] }}"
|
|
when:
|
|
- status.stdout.find("io.murano.applications") == -1 or kolla_action == "upgrade"
|